PT-2020-15858

Name of the Vulnerable Software and Affected Versions ElkarBackup version 1.3.3 Description A Persistent Cross-site Scripting issue is found, allowing an attacker to steal the user session cookie. This issue is present on the Policies action Name Parameter. Recommendations For ElkarBackup version...

CVE-2020-22158

MediaKind formerly Ericsson RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker...

CVE-2020-22158: Improper Neutralization of Input During Web Page Generation

MediaKind formerly Ericsson RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker...

CVE-2020-25253

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter...

PT-2020-16033 · Hyland · Onbase

Name of the Vulnerable Software and Affected Versions: Hyland OnBase versions prior to 18.0.0.33 and versions 19.x through 19.8.9.1000 Description: An issue exists where directory traversal is possible, allowing writing to files. This is demonstrated through the FileName parameter. Recommendation...

Hyland OnBase Directory Traversal Vulnerability (CNVD-2020-51794)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to write to a file via the FileName parameter...

Hyland OnBase Directory Traversal Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to read a file via the FileName parameter...

DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-49086)

DBHcms is a small, free and open source content management system for personal and small business websites. A reflective cross-site scripting vulnerability exists in DBHcms 1.2.0. The vulnerability stems from the failure of a security filter for the $GET'returnname' parameter in...

CVE-2020-19881

DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $GET'returnname' parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CentOS Web Panel Code Execution Vulnerability (CNVD-2020-43139)

CentOS Web Panel CWP is a free web hosting control panel that makes it easy to manage multiple servers Dedicated and VPS without having to access the servers via SSH. A code execution vulnerability in CentOS Web Panel version cwp-e17.0.9.8.923, which stems from the ajaxdiskusage.php file not...

CVE-2020-10989

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

CVE-2020-14946

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-6956

PCS DEXICON 3.4.1 allows XSS via the loginName parameter in loginaction.jsp...

CVE-2020-6956

PCS DEXICON 3.4.1 allows XSS via the loginName parameter in loginaction.jsp...

Tryton 5.4 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Tryton 5.4 - Persistent Cross-Site Scripting Vendor Homepage: https://www.tryton.org/ Version: 5.4 Software Link: https://www.tryton.org/download Document Title: =============== Tryton v5.4 - Name Persistent Cross Site...

CVE-2020-9461

Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable...

Fortinet FortiADC Cross-Site Scripting Vulnerability (CNVD-2020-28473)

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiADC. An attacker can exploit this vulnerability to execute code or commands with the 'name' parameter...

CVE-2020-6647

An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack XSS via the name parameter...

CVE-2020-6647: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack XSS via the name parameter...

PT-2020-5536

Name of the Vulnerable Software and Affected Versions FortiADC affected versions not specified Description The issue is related to an improper neutralization of input in the FortiADC dashboard, allowing an authenticated attacker to perform a cross-site scripting attack XSS via the name parameter...